PkgRadar

npm · registry.npmjs.org

@gbits-jszx/dg-cli-darwin-arm64

Install Lifecycle Remote Or Exec: postinstall="node -e \"try{require('fs').chmodSync(require('path').join(__dirname,'bin','dg-cli'),0o755)}catch(e){}\""

Why PkgRadar flagged 0.3.6

SeveritySignalEvidence
highInstall Lifecycle Remote Or Execpostinstall="node -e \"try{require('fs').chmodSync(require('path').join(__dirname,'bin','dg-cli'),0o755)}catch(e){}\"" · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
0.3.6High risk352026-06-10
0.3.5High risk352026-06-10
0.3.4High risk352026-06-10
0.3.3High risk352026-06-10
0.3.2High risk352026-06-10
0.3.1High risk352026-06-10
0.3.0High risk352026-06-10
0.8.1Low risk02026-06-09
0.8.0Low risk02026-06-08
0.4.1Low risk02026-06-08
0.4.0Low risk02026-06-08
0.2.0Review52026-05-27
0.1.11Review52026-05-27
0.1.10Review52026-05-27
0.1.8Review52026-05-27
0.1.9Review52026-05-27

Campaign attribution

Part of the Clob dropper campaign.

Block this in CI

PkgRadar gates @gbits-jszx/dg-cli-darwin-arm64 (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @gbits-jszx/[email protected]
Start free — 25 scans / moView full evidence